Hayabusa high test sigma

PowerShell Logging Disabled Via Registry Key Tampering

Detects changes to the registry for the currently logged-in user. In order to disable PowerShell module logging, script block logging or transcription and script execution logging

View Source

Detection Logic

{
  "registry_set": {
    "EventID": 4657,
    "Channel": "Security"
  },
  "selection": {
    "ObjectName
| contains": [
      "\\Microsoft\\Windows\\PowerShell\\",
      "\\Microsoft\\PowerShellCore\\"
    ],
    "ObjectName
| endswith": [
      "\\ModuleLogging\\EnableModuleLogging",
      "\\ScriptBlockLogging\\EnableScriptBlockLogging",
      "\\ScriptBlockLogging\\EnableScriptBlockInvocationLogging",
      "\\Transcription\\EnableTranscripting",
      "\\Transcription\\EnableInvocationHeader",
      "\\EnableScripts"
    ],
    "NewValue": "DWORD (0x00000000)"
  },
  "condition": "registry_set and selection"
}

False Positives

  • ⚠ Unknown

Field Validations

Loading…

Comments (0)

Loading comments...